The present invention relates to computer software analysis and testing in general.
Computer software applications are often analyzed to determine whether they are vulnerable to malicious attacks or otherwise show signs of security vulnerabilities. One such type of analysis known as “white-box” testing involves statically analyzing the instructions of a computer software application without executing the application. Another type of analysis known as “black-box” testing involves executing a computer software application and attacking the application using known forms of malicious attacks. Yet another type of analysis combines black-box testing with monitoring the execution of a computer software application that has been specially instrumented to detect black-box attacks. Despite the use of such analyses, application developers spend a great deal of time manually poring over application instructions in order to make sense of the results of such analyses to identify actual security vulnerabilities.